Is Appointment Booking Calendar Plugin and Scheduling Plugin safe?

Every recorded flaw

• Aug 29, 2026Appointment Booking Calendar Plugin and Scheduling: Does not verify the amount actually paid against the server-side price staged for a bookingCVE-2026-76586 · fixed in 1.6.3 · reported by WPScanHigh 7.5
• Jul 8, 2026Appointment Booking Calendar Plugin and Scheduling: Does not validate data before passing it to a PHP deserialization functionCVE-2026-12378 · affects up to 1.1.28 · reported by WPScanHigh 8.1
• Apr 1, 2025BookingPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31910 · affects up to 1.1.28 · reported by PatchstackHigh 7.6
• Jan 24, 2025BookingPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24732 · affects up to 1.1.25 · reported by PatchstackMedium 6.5
• Jan 13, 2025Appointment Booking Calendar Plugin and Scheduling: Export settings functionality exports data to a public folderCVE-2024-12274 · fixed in 1.1.23 · reported by WPScanHigh 7.5
• Dec 24, 2024Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress: SQL InjectionCVE-2024-11726 · affects up to 1.1.21 · reported by WordfenceMedium 6.5
• Nov 1, 2024Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress: SQL InjectionCVE-2024-10540 · affects up to 1.1.16 · reported by WordfenceMedium 5.3
• Aug 7, 2024Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress: Authentication bypassCVE-2024-7350 · affects 1.1.6 to 1.1.7 · reported by WordfenceCritical 9.8
• Jul 17, 2024BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Unauthorized modification of data that can lead to privilege escalationCVE-2024-6660 · affects up to 1.1.5 · reported by WordfenceHigh 8.8
• Jul 17, 2024BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Arbitrary File Read to Arbitrary File CreationCVE-2024-6467 · affects up to 1.1.5 · reported by WordfenceHigh 8.8
• Jun 11, 2024BookingPress: Missing AuthorizationCVE-2024-34799 · affects up to 1.0.82 · reported by PatchstackMedium 6.5
• Apr 24, 2024BookingPress: Improper AuthenticationCVE-2023-51405 · affects up to 1.0.74 · reported by PatchstackHigh 8.2
• Apr 7, 2024BookingPress: Authorization Bypass Through User-Controlled KeyCVE-2024-31296 · affects up to 1.0.81 · reported by PatchstackMedium 4.3
• Apr 3, 2024BookingPress: Arbitrary file uploadsCVE-2024-3022 · affects up to 1.0.87 · reported by Wordfence1.6% oddsHigh 7.2
• Dec 28, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50841 · affects up to 1.0.72 · reported by PatchstackHigh 8.5
• Nov 30, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36507 · affects up to 1.0.64 · reported by PatchstackMedium 5.3
• Nov 27, 2023BookingPress: Arbitrary file uploadsCVE-2023-6219 · affects up to 1.0.76 · reported by Wordfence1.2% oddsHigh 7.2
• Jan 2, 2023BookingPress: Suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you pageCVE-2022-4340 · fixed in 1.0.31 · reported by WPScanMedium 5.3
• Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · fixed in 1.0.11 · reported by WPScan37% oddsCritical 9.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.